North Korean Crypto Network Uncovered: Solana and Ethereum Laundering Schemes Revealed by ZachXBT

• Blockchain analyst ZachXBT has recently exposed a sophisticated North Korean crypto network.
• The investigation points to complex laundering techniques and ties to individuals sanctioned by authorities like OFAC.
• “Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities,” ZachXBT revealed.

Discover how a North Korean developer network is orchestrating a significant crypto laundering operation, earning substantial monthly revenues through elaborate schemes.

Unveiling the North Korean Crypto Scam

ZachXBT’s report highlights a well-coordinated effort by North Korean developers operating within the crypto space who are potentially earning between $300,000 and $500,000 monthly. Shared on August 15th, the analysis suggests that a single entity in Asia, likely linked to North Korea, orchestrates these activities. The group comprises 21 developers working across more than 25 crypto projects, indicating a hidden and influential presence in the global cryptocurrency market.

The Mechanics of the Laundering Scheme

The laundering methodology identified in the investigation involves transferring stolen funds of $1.3 million to an address, bridging it from Solana (SOL) to Ethereum (ETH). Subsequently, 50.2 ETH gets deposited into Tornado Cash, and 16.5 ETH is moved to two exchanges. By tracing various payment addresses associated with the developers, ZachXBT uncovered recent transactions totaling approximately $375,000, showcasing the intricate financial operations within this network.

Key Individuals and Their Roles

The investigation pointed out individuals like Sim Hyon Sop and Sang Man Kim, linked to OFAC sanctions, suggesting their significant contribution to the scheme. Payments to DPRK IT workers were routed through an exchange address that received $5.5 million from July 2023 to 2024. Moreover, Kim is implicated in managing cyber funds and facilitating IT sales to DPRK teams in China and Russia. The placing agencies and referrals within professional circles further facilitated these schemes, involving unsuspecting development teams.

Aftermath and Reactions

Upon exposure, one DPRK IT worker, Naoki Murano, swiftly exited communication channels and deleted his GitHub account, signifying a desperate attempt to distance himself from the network. This reaction was likely fueled by fears of being identified and repercussions from the investigation.

Conclusion

This investigation sheds light on the extensive and covert operations of North Korean developers within the cryptocurrency sphere. The exposure emphasizes the need for heightened vigilance and scrutiny within the crypto community to prevent similar exploitations in the future.